MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8ee7639d6ed8ac99078c59880ffbc783644c6198e925d7344542e4806379c04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8ee7639d6ed8ac99078c59880ffbc783644c6198e925d7344542e4806379c04
SHA3-384 hash: 8cda833a7b00c8d63d502181f3d36129d85d1c4acaf2dc3c389e4639428380966c4d3a01b2af166e92d667f1591ad964
SHA1 hash: c334f486ac3418ce2f4c84a1bbba06a359d24cc7
MD5 hash: 77026c7ea3637478a33227d5719fc8e4
humanhash: delaware-autumn-november-three
File name:77026c7ea3637478a33227d5719fc8e4
Download: download sample
Signature FormBook
Create hunting rule
File size:895'488 bytes
First seen:2020-11-17 11:35:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:WV/pLGfxXmxXMS9Wjy7ABMdj6ijMPCTeqS3agUhBoMeWKafeYAfLJ5QyS:KrQyEit6zqJgUPoiKafQLJ+
TLSH 8A1516FEB65CDBD3ECE8F275611A040683E89C22D6D1C688BFCD3ACE446C92D7A52115
Reporter seifreed
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Launching cmd.exe command interpreter
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8ee7639d6ed8ac99078c59880ffbc783644c6198e925d7344542e4806379c04/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 06:35:00 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5dxhmoow5wfmtedyywmib754pa3ejrqzr2jf242ekqxeqbrxtqca._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201117-pgjb5qb7xe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.wasteofspaceclearance.com/yc9/
Unpacked files
SH256 hash:
e8ee7639d6ed8ac99078c59880ffbc783644c6198e925d7344542e4806379c04
MD5 hash:
77026c7ea3637478a33227d5719fc8e4
SHA1 hash:
c334f486ac3418ce2f4c84a1bbba06a359d24cc7
Link:
https://www.unpac.me/results/86e5d5e1-2483-43ee-9f8d-0d7142c4623c/
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
Link:
https://www.unpac.me/results/86e5d5e1-2483-43ee-9f8d-0d7142c4623c/
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
Link:
https://www.unpac.me/results/86e5d5e1-2483-43ee-9f8d-0d7142c4623c/
SH256 hash:
e73af328bb2893c74559ce76354ede1410831068a801747ec7f2cbe07a60c697
MD5 hash:
cacdf50583c1a2b61cae758716cf95e7
SHA1 hash:
99b8b15bad20ba4cac8286db32ed5648c41b641d
Link:
https://www.unpac.me/results/86e5d5e1-2483-43ee-9f8d-0d7142c4623c/
SH256 hash:
1617150c1a9b6f593660f9dc5582f3fb5362736b8a187bac3c0bc8326d2d7a68
MD5 hash:
f75440cc934e3b4ed7f8be2e4e71d144
SHA1 hash:
fd16e93fec78cd834509770073c0c18c8fcba63a
Link:
https://www.unpac.me/results/86e5d5e1-2483-43ee-9f8d-0d7142c4623c/
SH256 hash:
f5d96e2e1c1feb865f399a36ced62be02c14a7c848e894811b1849ee9cff90f0
MD5 hash:
55e3d42497f2afc14f6bdd712f3a10fd
SHA1 hash:
cb09635db9a8c2eda4836b695a2a90e0c15be04f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/86e5d5e1-2483-43ee-9f8d-0d7142c4623c/
Parent samples :
e8ee7639d6ed8ac99078c59880ffbc783644c6198e925d7344542e4806379c04
06c53a780f67985794c7652bfcdbda9309d7a9b707578fda7dfc8ceb5d7bc9c7
03c495ebfcd620a041e0e06a8f25150e27ad5445f31d1fcd502c1845ae1ad87b
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments